runonce[.]zip | Triage

Resubmissions

02/01/2023, 15:59

230102-tfexhahh9y 1

02/01/2023, 15:40

230102-s38bwshh7y 1

Sharing

Copy URL Twitter E-mail

General

Target

runonce.zip
Size

34KB
MD5

55052c7858c365838b33e53af20a6b9d
SHA1

5d986f48d23e9e3b90d83335020b96addd65f488
SHA256

cfcd6473ffed5f7df64d0ce0f4e1cdf38700de9440283959eb9fc7c8af4381b7
SHA512

cbbe07618818e901b654756f646b61e8cef8faddfe5733821fd559c1a4b1eb6a13ef9d9578be268ad139c8581d396e8ea3d91eba5e5f18ed0a0e5c8555244498
SSDEEP

768:FM5r9duA68DvfK8qJyxOcH0w9hNGrBNzDMPyVGUXHzoBUoSDmOr1s5b+:A9hjK8vxO6wBFD/VtzokmOBN

Score

N/A

Malware Config

Signatures

Files

runonce.zip
.zip
runonce.exe
.exe windows x64

7e1285c71d77a5f5f49eab29e20ff220

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegOpenKeyExW
RegDeleteValueW
RegCloseKey
RegEnumValueW
RegDeleteKeyW
RegQueryValueExW
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister

kernel32

LocalFree
CreateProcessW
AssignProcessToJobObject
SetInformationJobObject
SetTermsrvAppInstallMode
LocalAlloc
lstrlenW
WaitForSingleObjectEx
HeapSetInformation
ExitProcess
GetProcAddress
LoadLibraryW
CreateThread
GetPrivateProfileIntW
CloseHandle
CreateJobObjectW

gdi32

CreateSolidBrush
GetObjectW
CreateFontIndirectW
SelectObject
GetTextExtentPointW
DeleteObject
CreateCompatibleDC
BitBlt
SetBkColor
ExtTextOutW

user32

DispatchMessageW
LoadCursorW
SetCursor
TranslateMessage
PostQuitMessage
PeekMessageW
MsgWaitForMultipleObjectsEx
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
GetParent
DialogBoxParamW
GetWindowTextW
EndDialog
LoadStringW
ExitWindowsEx
PostMessageW
DrawTextW
LoadBitmapW
MessageBeep
GetWindowRect
ReleaseDC
GetDC
SendMessageW
MessageBoxW
GetSystemMetrics
GetDlgItem
SetWindowPos
GetSysColor

msvcrt

__C_specific_handler
_callnewh
malloc
_XcptFilter
_amsg_exit
__CxxFrameHandler3
free
wcsrchr
_purecall
memcpy_s
_vsnwprintf
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
memset
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs

comctl32

ord329
ord334
ord328

shell32

ord723
ord100
ord885
SHEvaluateSystemCommandTemplate
ord165
SHParseDisplayName
SHBindToParent
ord155

shlwapi

ord158
ord437
ord219
ord176
PathQuoteSpacesW
ord174
ord618
ord460
SHDeleteValueW
ord388
SHGetValueW
PathFindFileNameW
ord217
ord199

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles
CoGetApartmentType
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoUninitialize

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-processthreads-l1-1-0

ResumeThread
GetCurrentProcess
GetProcessId
SetPriorityClass
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetStartupInfoW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetVersionExW
GetWindowsDirectoryW

api-ms-win-core-synch-l1-1-0

SetEvent
ReleaseMutex
CreateMutexExW
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjectsEx
CreateEventExW
CreateSemaphoreExW
CreateEventW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegGetValueW
RegQueryInfoKeyW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
GetQueuedCompletionStatus

api-ms-win-core-path-l1-1-0

PathCchAddExtension
PathCchAppend

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventEnabled

api-ms-win-core-winrt-l1-1-0

RoActivateInstance
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsDeleteString

api-ms-win-core-string-l2-1-0

IsCharAlphaNumericW
CharLowerW

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-eventing-controller-l1-1-0

StopTraceW
StartTraceW
EnableTraceEx2

api-ms-win-core-file-l1-1-0

DeleteFileW

ntdll

NtQueryInformationProcess
RtlNtStatusToDosError

ole32

CoInitialize

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

7e1285c71d77a5f5f49eab29e20ff220

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

comctl32

shell32

shlwapi

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-file-l1-1-0

ntdll

ole32

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 252B

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 252B